Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
26-12-2024 09:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b297cb668eb53292630832b8bf44bdc0a9ee50063f27ef37aba908cd9111d086.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
120 seconds
General
-
Target
b297cb668eb53292630832b8bf44bdc0a9ee50063f27ef37aba908cd9111d086.exe
-
Size
456KB
-
MD5
6aa204ccb952d4cbe50e49d7c9f2be9c
-
SHA1
8f88775b0fa83df85ff9de2554c930dfba7d860c
-
SHA256
b297cb668eb53292630832b8bf44bdc0a9ee50063f27ef37aba908cd9111d086
-
SHA512
18e7d7c66f117c0f0b717307253b00472c290e41a5690c24fccda4197ff44ca7a17af83ac7e5e473473ae1ab4273ba25a41ed377d0fcb411e1b721176affa16d
-
SSDEEP
6144:8cm7ImGddXmNt251UriZFwfsDX2UznsaFVNJCMKAbeR2:q7Tc2NYHUrAwfMp3CDR2
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 45 IoCs
resource yara_rule behavioral1/memory/2224-7-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-20-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2236-16-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2680-30-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2400-39-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2868-49-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2780-61-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2592-70-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3000-78-0x00000000003C0000-0x00000000003EA000-memory.dmp family_blackmoon behavioral1/memory/1980-88-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2000-124-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1616-134-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1616-136-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-138-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2072-144-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/296-154-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2128-164-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2824-173-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1096-223-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2500-248-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2520-282-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/2500-277-0x00000000005C0000-0x00000000005EA000-memory.dmp family_blackmoon behavioral1/memory/1764-276-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1336-298-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2324-313-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2804-321-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2776-341-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3044-348-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2508-367-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/3048-381-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2892-396-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/2892-397-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1556-411-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/1528-419-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1528-417-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon behavioral1/memory/1740-440-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2180-460-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/568-540-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2308-553-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2980-561-0x00000000001B0000-0x00000000001DA000-memory.dmp family_blackmoon behavioral1/memory/1852-665-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2900-684-0x00000000003A0000-0x00000000003CA000-memory.dmp family_blackmoon behavioral1/memory/1552-711-0x0000000001C60000-0x0000000001C8A000-memory.dmp family_blackmoon behavioral1/memory/1472-719-0x0000000000400000-0x000000000042A000-memory.dmp family_blackmoon behavioral1/memory/2312-733-0x0000000000220000-0x000000000024A000-memory.dmp family_blackmoon -
Executes dropped EXE 64 IoCs
pid Process 2236 jvjdv.exe 2680 bhbbnt.exe 2400 btthnt.exe 2868 vvvvd.exe 2780 xxxlrlf.exe 2592 lrlflxl.exe 3000 nbtbtn.exe 1980 nnbnbn.exe 948 5hbtbn.exe 2880 fxxlfll.exe 2040 hhbhbh.exe 2000 1flflxl.exe 1616 djjvp.exe 2072 hbbnnb.exe 296 pppdv.exe 2128 jjjdj.exe 2824 nnnntn.exe 2940 hhntnb.exe 2016 vpvpd.exe 2220 nbthbn.exe 1324 flrrrfx.exe 904 jddjp.exe 1096 rllxlrf.exe 1356 1dvpj.exe 2672 lfrrfll.exe 2500 rxflfxr.exe 2308 ntbnnh.exe 2532 9tbhbh.exe 1764 vddvj.exe 2520 nbntnn.exe 1196 5vpdj.exe 1336 pjpdd.exe 2324 3lxxlff.exe 2804 pvjpj.exe 2932 rxrxlff.exe 2788 dpjjp.exe 2776 rrrrflr.exe 3044 tbhbth.exe 1048 dvppj.exe 2632 xxxfrxx.exe 2508 bbhnth.exe 2172 jdddj.exe 3048 btnntb.exe 576 ddjvj.exe 2892 frrrrff.exe 2676 hhhnth.exe 1556 dvppp.exe 1528 7lrrxlr.exe 1632 jjddv.exe 1664 lxflrxf.exe 1740 nbhhbh.exe 1976 ddpvd.exe 1928 rlxrfxf.exe 2180 bttnht.exe 1352 jpvjj.exe 2300 htbttn.exe 2916 djjvj.exe 2012 ffrxxff.exe 952 rrfrlxx.exe 1032 tbnhbt.exe 868 ppvjj.exe 2964 frrrrfx.exe 2100 jvpjd.exe 1600 vvvpp.exe -
resource yara_rule behavioral1/memory/2224-7-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-21-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2236-20-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2680-30-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2400-39-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-51-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2868-49-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2780-61-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2592-70-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1980-88-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2000-124-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1616-136-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2072-138-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/296-154-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2128-164-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2824-173-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1096-223-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2500-248-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2520-278-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1764-276-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1336-298-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2324-313-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2804-321-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2776-341-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3044-348-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2508-367-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/3048-381-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2892-394-0x00000000001B0000-0x00000000001DA000-memory.dmp upx behavioral1/memory/2892-397-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1556-411-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1740-440-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1976-441-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2180-460-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/568-540-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-553-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2308-574-0x00000000003C0000-0x00000000003EA000-memory.dmp upx behavioral1/memory/2480-575-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2600-625-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2736-635-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1852-665-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/2636-666-0x0000000000400000-0x000000000042A000-memory.dmp upx behavioral1/memory/1472-719-0x0000000000400000-0x000000000042A000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhnnht.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xrrrxxl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ppjpd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxxlxll.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rxlrflf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jpjvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 7djvp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ddvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lllfxrf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language flrrrfx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9dvdp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dvvjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xfxrxlr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hhntnb.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pvvpj.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language jddjv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5xrlrrx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language xxflflr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Process not Found Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language nnnbth.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2224 wrote to memory of 2236 2224 b297cb668eb53292630832b8bf44bdc0a9ee50063f27ef37aba908cd9111d086.exe 30 PID 2224 wrote to memory of 2236 2224 b297cb668eb53292630832b8bf44bdc0a9ee50063f27ef37aba908cd9111d086.exe 30 PID 2224 wrote to memory of 2236 2224 b297cb668eb53292630832b8bf44bdc0a9ee50063f27ef37aba908cd9111d086.exe 30 PID 2224 wrote to memory of 2236 2224 b297cb668eb53292630832b8bf44bdc0a9ee50063f27ef37aba908cd9111d086.exe 30 PID 2236 wrote to memory of 2680 2236 jvjdv.exe 31 PID 2236 wrote to memory of 2680 2236 jvjdv.exe 31 PID 2236 wrote to memory of 2680 2236 jvjdv.exe 31 PID 2236 wrote to memory of 2680 2236 jvjdv.exe 31 PID 2680 wrote to memory of 2400 2680 bhbbnt.exe 32 PID 2680 wrote to memory of 2400 2680 bhbbnt.exe 32 PID 2680 wrote to memory of 2400 2680 bhbbnt.exe 32 PID 2680 wrote to memory of 2400 2680 bhbbnt.exe 32 PID 2400 wrote to memory of 2868 2400 btthnt.exe 33 PID 2400 wrote to memory of 2868 2400 btthnt.exe 33 PID 2400 wrote to memory of 2868 2400 btthnt.exe 33 PID 2400 wrote to memory of 2868 2400 btthnt.exe 33 PID 2868 wrote to memory of 2780 2868 vvvvd.exe 34 PID 2868 wrote to memory of 2780 2868 vvvvd.exe 34 PID 2868 wrote to memory of 2780 2868 vvvvd.exe 34 PID 2868 wrote to memory of 2780 2868 vvvvd.exe 34 PID 2780 wrote to memory of 2592 2780 xxxlrlf.exe 35 PID 2780 wrote to memory of 2592 2780 xxxlrlf.exe 35 PID 2780 wrote to memory of 2592 2780 xxxlrlf.exe 35 PID 2780 wrote to memory of 2592 2780 xxxlrlf.exe 35 PID 2592 wrote to memory of 3000 2592 lrlflxl.exe 36 PID 2592 wrote to memory of 3000 2592 lrlflxl.exe 36 PID 2592 wrote to memory of 3000 2592 lrlflxl.exe 36 PID 2592 wrote to memory of 3000 2592 lrlflxl.exe 36 PID 3000 wrote to memory of 1980 3000 nbtbtn.exe 37 PID 3000 wrote to memory of 1980 3000 nbtbtn.exe 37 PID 3000 wrote to memory of 1980 3000 nbtbtn.exe 37 PID 3000 wrote to memory of 1980 3000 nbtbtn.exe 37 PID 1980 wrote to memory of 948 1980 nnbnbn.exe 38 PID 1980 wrote to memory of 948 1980 nnbnbn.exe 38 PID 1980 wrote to memory of 948 1980 nnbnbn.exe 38 PID 1980 wrote to memory of 948 1980 nnbnbn.exe 38 PID 948 wrote to memory of 2880 948 5hbtbn.exe 39 PID 948 wrote to memory of 2880 948 5hbtbn.exe 39 PID 948 wrote to memory of 2880 948 5hbtbn.exe 39 PID 948 wrote to memory of 2880 948 5hbtbn.exe 39 PID 2880 wrote to memory of 2040 2880 fxxlfll.exe 40 PID 2880 wrote to memory of 2040 2880 fxxlfll.exe 40 PID 2880 wrote to memory of 2040 2880 fxxlfll.exe 40 PID 2880 wrote to memory of 2040 2880 fxxlfll.exe 40 PID 2040 wrote to memory of 2000 2040 hhbhbh.exe 41 PID 2040 wrote to memory of 2000 2040 hhbhbh.exe 41 PID 2040 wrote to memory of 2000 2040 hhbhbh.exe 41 PID 2040 wrote to memory of 2000 2040 hhbhbh.exe 41 PID 2000 wrote to memory of 1616 2000 1flflxl.exe 42 PID 2000 wrote to memory of 1616 2000 1flflxl.exe 42 PID 2000 wrote to memory of 1616 2000 1flflxl.exe 42 PID 2000 wrote to memory of 1616 2000 1flflxl.exe 42 PID 1616 wrote to memory of 2072 1616 djjvp.exe 43 PID 1616 wrote to memory of 2072 1616 djjvp.exe 43 PID 1616 wrote to memory of 2072 1616 djjvp.exe 43 PID 1616 wrote to memory of 2072 1616 djjvp.exe 43 PID 2072 wrote to memory of 296 2072 hbbnnb.exe 44 PID 2072 wrote to memory of 296 2072 hbbnnb.exe 44 PID 2072 wrote to memory of 296 2072 hbbnnb.exe 44 PID 2072 wrote to memory of 296 2072 hbbnnb.exe 44 PID 296 wrote to memory of 2128 296 pppdv.exe 45 PID 296 wrote to memory of 2128 296 pppdv.exe 45 PID 296 wrote to memory of 2128 296 pppdv.exe 45 PID 296 wrote to memory of 2128 296 pppdv.exe 45
Processes
-
C:\Users\Admin\AppData\Local\Temp\b297cb668eb53292630832b8bf44bdc0a9ee50063f27ef37aba908cd9111d086.exe"C:\Users\Admin\AppData\Local\Temp\b297cb668eb53292630832b8bf44bdc0a9ee50063f27ef37aba908cd9111d086.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
\??\c:\jvjdv.exec:\jvjdv.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
\??\c:\bhbbnt.exec:\bhbbnt.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2680 -
\??\c:\btthnt.exec:\btthnt.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2400 -
\??\c:\vvvvd.exec:\vvvvd.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2868 -
\??\c:\xxxlrlf.exec:\xxxlrlf.exe6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2780 -
\??\c:\lrlflxl.exec:\lrlflxl.exe7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2592 -
\??\c:\nbtbtn.exec:\nbtbtn.exe8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3000 -
\??\c:\nnbnbn.exec:\nnbnbn.exe9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1980 -
\??\c:\5hbtbn.exec:\5hbtbn.exe10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:948 -
\??\c:\fxxlfll.exec:\fxxlfll.exe11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2880 -
\??\c:\hhbhbh.exec:\hhbhbh.exe12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2040 -
\??\c:\1flflxl.exec:\1flflxl.exe13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2000 -
\??\c:\djjvp.exec:\djjvp.exe14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1616 -
\??\c:\hbbnnb.exec:\hbbnnb.exe15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2072 -
\??\c:\pppdv.exec:\pppdv.exe16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:296 -
\??\c:\jjjdj.exec:\jjjdj.exe17⤵
- Executes dropped EXE
PID:2128 -
\??\c:\nnnntn.exec:\nnnntn.exe18⤵
- Executes dropped EXE
PID:2824 -
\??\c:\hhntnb.exec:\hhntnb.exe19⤵
- Executes dropped EXE
PID:2940 -
\??\c:\vpvpd.exec:\vpvpd.exe20⤵
- Executes dropped EXE
PID:2016 -
\??\c:\nbthbn.exec:\nbthbn.exe21⤵
- Executes dropped EXE
PID:2220 -
\??\c:\flrrrfx.exec:\flrrrfx.exe22⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1324 -
\??\c:\jddjp.exec:\jddjp.exe23⤵
- Executes dropped EXE
PID:904 -
\??\c:\rllxlrf.exec:\rllxlrf.exe24⤵
- Executes dropped EXE
PID:1096 -
\??\c:\1dvpj.exec:\1dvpj.exe25⤵
- Executes dropped EXE
PID:1356 -
\??\c:\lfrrfll.exec:\lfrrfll.exe26⤵
- Executes dropped EXE
PID:2672 -
\??\c:\rxflfxr.exec:\rxflfxr.exe27⤵
- Executes dropped EXE
PID:2500 -
\??\c:\ntbnnh.exec:\ntbnnh.exe28⤵
- Executes dropped EXE
PID:2308 -
\??\c:\9tbhbh.exec:\9tbhbh.exe29⤵
- Executes dropped EXE
PID:2532 -
\??\c:\vddvj.exec:\vddvj.exe30⤵
- Executes dropped EXE
PID:1764 -
\??\c:\nbntnn.exec:\nbntnn.exe31⤵
- Executes dropped EXE
PID:2520 -
\??\c:\5vpdj.exec:\5vpdj.exe32⤵
- Executes dropped EXE
PID:1196 -
\??\c:\pjpdd.exec:\pjpdd.exe33⤵
- Executes dropped EXE
PID:1336 -
\??\c:\3lxxlff.exec:\3lxxlff.exe34⤵
- Executes dropped EXE
PID:2324 -
\??\c:\pvjpj.exec:\pvjpj.exe35⤵
- Executes dropped EXE
PID:2804 -
\??\c:\rxrxlff.exec:\rxrxlff.exe36⤵
- Executes dropped EXE
PID:2932 -
\??\c:\dpjjp.exec:\dpjjp.exe37⤵
- Executes dropped EXE
PID:2788 -
\??\c:\rrrrflr.exec:\rrrrflr.exe38⤵
- Executes dropped EXE
PID:2776 -
\??\c:\tbhbth.exec:\tbhbth.exe39⤵
- Executes dropped EXE
PID:3044 -
\??\c:\dvppj.exec:\dvppj.exe40⤵
- Executes dropped EXE
PID:1048 -
\??\c:\xxxfrxx.exec:\xxxfrxx.exe41⤵
- Executes dropped EXE
PID:2632 -
\??\c:\bbhnth.exec:\bbhnth.exe42⤵
- Executes dropped EXE
PID:2508 -
\??\c:\jdddj.exec:\jdddj.exe43⤵
- Executes dropped EXE
PID:2172 -
\??\c:\btnntb.exec:\btnntb.exe44⤵
- Executes dropped EXE
PID:3048 -
\??\c:\ddjvj.exec:\ddjvj.exe45⤵
- Executes dropped EXE
PID:576 -
\??\c:\frrrrff.exec:\frrrrff.exe46⤵
- Executes dropped EXE
PID:2892 -
\??\c:\hhhnth.exec:\hhhnth.exe47⤵
- Executes dropped EXE
PID:2676 -
\??\c:\dvppp.exec:\dvppp.exe48⤵
- Executes dropped EXE
PID:1556 -
\??\c:\7lrrxlr.exec:\7lrrxlr.exe49⤵
- Executes dropped EXE
PID:1528 -
\??\c:\jjddv.exec:\jjddv.exe50⤵
- Executes dropped EXE
PID:1632 -
\??\c:\lxflrxf.exec:\lxflrxf.exe51⤵
- Executes dropped EXE
PID:1664 -
\??\c:\nbhhbh.exec:\nbhhbh.exe52⤵
- Executes dropped EXE
PID:1740 -
\??\c:\ddpvd.exec:\ddpvd.exe53⤵
- Executes dropped EXE
PID:1976 -
\??\c:\rlxrfxf.exec:\rlxrfxf.exe54⤵
- Executes dropped EXE
PID:1928 -
\??\c:\bttnht.exec:\bttnht.exe55⤵
- Executes dropped EXE
PID:2180 -
\??\c:\jpvjj.exec:\jpvjj.exe56⤵
- Executes dropped EXE
PID:1352 -
\??\c:\htbttn.exec:\htbttn.exe57⤵
- Executes dropped EXE
PID:2300 -
\??\c:\djjvj.exec:\djjvj.exe58⤵
- Executes dropped EXE
PID:2916 -
\??\c:\ffrxxff.exec:\ffrxxff.exe59⤵
- Executes dropped EXE
PID:2012 -
\??\c:\rrfrlxx.exec:\rrfrlxx.exe60⤵
- Executes dropped EXE
PID:952 -
\??\c:\tbnhbt.exec:\tbnhbt.exe61⤵
- Executes dropped EXE
PID:1032 -
\??\c:\ppvjj.exec:\ppvjj.exe62⤵
- Executes dropped EXE
PID:868 -
\??\c:\frrrrfx.exec:\frrrrfx.exe63⤵
- Executes dropped EXE
PID:2964 -
\??\c:\jvpjd.exec:\jvpjd.exe64⤵
- Executes dropped EXE
PID:2100 -
\??\c:\vvvpp.exec:\vvvpp.exe65⤵
- Executes dropped EXE
PID:1600 -
\??\c:\lllxxfx.exec:\lllxxfx.exe66⤵PID:1688
-
\??\c:\tnthhb.exec:\tnthhb.exe67⤵PID:568
-
\??\c:\pppvj.exec:\pppvj.exe68⤵PID:2336
-
\??\c:\9rflfrl.exec:\9rflfrl.exe69⤵PID:2308
-
\??\c:\htbnnb.exec:\htbnnb.exe70⤵PID:2980
-
\??\c:\rxlflfr.exec:\rxlflfr.exe71⤵PID:2920
-
\??\c:\nbnnbt.exec:\nbnnbt.exe72⤵PID:2268
-
\??\c:\9jvpp.exec:\9jvpp.exe73⤵PID:2480
-
\??\c:\bbhhtn.exec:\bbhhtn.exe74⤵PID:2152
-
\??\c:\vdjpp.exec:\vdjpp.exe75⤵PID:1544
-
\??\c:\xrflxxl.exec:\xrflxxl.exe76⤵PID:2808
-
\??\c:\nhbhtb.exec:\nhbhtb.exe77⤵PID:2816
-
\??\c:\lrfxlfr.exec:\lrfxlfr.exe78⤵PID:2700
-
\??\c:\htbbnb.exec:\htbbnb.exe79⤵PID:2736
-
\??\c:\jvvjd.exec:\jvvjd.exe80⤵PID:1856
-
\??\c:\9fllfrl.exec:\9fllfrl.exe81⤵PID:2600
-
\??\c:\9hnhht.exec:\9hnhht.exe82⤵PID:2572
-
\??\c:\jvdvp.exec:\jvdvp.exe83⤵PID:2648
-
\??\c:\xlrffrr.exec:\xlrffrr.exe84⤵PID:2604
-
\??\c:\9tnbtt.exec:\9tnbtt.exe85⤵PID:3020
-
\??\c:\vvdjd.exec:\vvdjd.exe86⤵PID:1852
-
\??\c:\xxflfrr.exec:\xxflfrr.exe87⤵PID:2636
-
\??\c:\nbhhbb.exec:\nbhhbb.exe88⤵PID:2828
-
\??\c:\xlfffrr.exec:\xlfffrr.exe89⤵PID:2900
-
\??\c:\tnbtbt.exec:\tnbtbt.exe90⤵PID:1992
-
\??\c:\dvjvp.exec:\dvjvp.exe91⤵PID:1720
-
\??\c:\frrlfll.exec:\frrlfll.exe92⤵PID:1152
-
\??\c:\ntbtht.exec:\ntbtht.exe93⤵PID:1552
-
\??\c:\jpvvv.exec:\jpvvv.exe94⤵PID:1472
-
\??\c:\rlfxxfl.exec:\rlfxxfl.exe95⤵PID:320
-
\??\c:\nnnbth.exec:\nnnbth.exe96⤵
- System Location Discovery: System Language Discovery
PID:2312 -
\??\c:\3vvdj.exec:\3vvdj.exe97⤵PID:2164
-
\??\c:\xllxxll.exec:\xllxxll.exe98⤵PID:2948
-
\??\c:\bhbthh.exec:\bhbthh.exe99⤵PID:912
-
\??\c:\vjjdj.exec:\vjjdj.exe100⤵PID:2956
-
\??\c:\rrrrfrl.exec:\rrrrfrl.exe101⤵PID:1500
-
\??\c:\nntbth.exec:\nntbth.exe102⤵PID:1900
-
\??\c:\jppjd.exec:\jppjd.exe103⤵PID:1092
-
\??\c:\djvpv.exec:\djvpv.exe104⤵PID:1052
-
\??\c:\rlrxrff.exec:\rlrxrff.exe105⤵PID:1812
-
\??\c:\hntnbn.exec:\hntnbn.exe106⤵PID:1776
-
\??\c:\dpvpp.exec:\dpvpp.exe107⤵PID:1708
-
\??\c:\1xrlfxr.exec:\1xrlfxr.exe108⤵PID:1712
-
\??\c:\xflffll.exec:\xflffll.exe109⤵PID:616
-
\??\c:\5bhnht.exec:\5bhnht.exe110⤵PID:2512
-
\??\c:\vvdvv.exec:\vvdvv.exe111⤵PID:2968
-
\??\c:\xxxflrx.exec:\xxxflrx.exe112⤵PID:1328
-
\??\c:\tbnhbn.exec:\tbnhbn.exe113⤵PID:2032
-
\??\c:\jjpdd.exec:\jjpdd.exe114⤵PID:3028
-
\??\c:\lrrflrr.exec:\lrrflrr.exe115⤵PID:2020
-
\??\c:\nntnht.exec:\nntnht.exe116⤵PID:2304
-
\??\c:\ddjpj.exec:\ddjpj.exe117⤵PID:892
-
\??\c:\flrfxll.exec:\flrfxll.exe118⤵PID:1580
-
\??\c:\hhhtnh.exec:\hhhtnh.exe119⤵PID:2136
-
\??\c:\7dppv.exec:\7dppv.exe120⤵PID:2944
-
\??\c:\lxlfrxl.exec:\lxlfrxl.exe121⤵PID:2708
-
\??\c:\thbbhb.exec:\thbbhb.exe122⤵PID:2692
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-